healer | d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed | Triage

Resubmissions

23-06-2024 06:12

240623-gyd2psscqf 10

16-07-2023 19:09

230716-xt4pkahc8t 10

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 06:12

Sharing

Report Analysis Logs

General

Target

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe
Size

787KB
MD5

36b9237f9ecf4c5c108cd7f67404b0e6
SHA1

4ccd5b450d77b42a4485bb2ddddce85c4dd89758
SHA256

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799
SHA512

1208a186e7ea814a817b9d59ff4a09a56ad94d5ea6e56bc5cfa9ae0a0f170c81b592b47de3d940b5cc2daf64ca582272fce2b77a0858a0909c926baa65e6b04a
SSDEEP

12288:lMroy9052D1VtAZGIKEkY0BaLiTBFbtcqMQ8e76H+4MEARgmWP:tyw2DSsrEkZDz8lHO2P

Score

10^/10

healer redline grom dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

grom

C2

83.97.73.129:19071

Attributes

auth_value
2193aac8692a5e1ec66d9db9fa25ee00

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral3/memory/2836-29-0x0000000000470000-0x000000000047A000-memory.dmp	healer
behavioral3/files/0x00070000000236af-36.dat	healer
behavioral3/memory/4456-38-0x0000000000700000-0x000000000070A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o1463937.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9233288.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral3/memory/5096-44-0x0000000000630000-0x0000000000660000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3452	z9821491.exe
1540	z9676291.exe
4492	z8837151.exe
2836	o1463937.exe
4456	p9233288.exe
5096	r2365043.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9233288.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9821491.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9676291.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z8837151.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2836	o1463937.exe
2836	o1463937.exe
4456	p9233288.exe
4456	p9233288.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	o1463937.exe
Token: SeDebugPrivilege	4456	p9233288.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3452	4996	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe	84
PID 4996 wrote to memory of 3452	4996	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe	84
PID 4996 wrote to memory of 3452	4996	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe	84
PID 3452 wrote to memory of 1540	3452	z9821491.exe	85
PID 3452 wrote to memory of 1540	3452	z9821491.exe	85
PID 3452 wrote to memory of 1540	3452	z9821491.exe	85
PID 1540 wrote to memory of 4492	1540	z9676291.exe	86
PID 1540 wrote to memory of 4492	1540	z9676291.exe	86
PID 1540 wrote to memory of 4492	1540	z9676291.exe	86
PID 4492 wrote to memory of 2836	4492	z8837151.exe	87
PID 4492 wrote to memory of 2836	4492	z8837151.exe	87
PID 4492 wrote to memory of 2836	4492	z8837151.exe	87
PID 4492 wrote to memory of 4456	4492	z8837151.exe	93
PID 4492 wrote to memory of 4456	4492	z8837151.exe	93
PID 1540 wrote to memory of 5096	1540	z9676291.exe	94
PID 1540 wrote to memory of 5096	1540	z9676291.exe	94
PID 1540 wrote to memory of 5096	1540	z9676291.exe	94

C:\Users\Admin\AppData\Local\Temp\053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe
"C:\Users\Admin\AppData\Local\Temp\053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9821491.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9821491.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9676291.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9676291.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8837151.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8837151.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o1463937.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o1463937.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2365043.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2365043.exe
      4⤵
      Executes dropped EXE
      PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9821491.exe

Filesize
593KB

MD5
f945267dddff61f9d38bb3df99448dc0

SHA1
f93e26c77aa382e29ffb318cc54a2056b48f89a9

SHA256
9092ab63010fed6a3724188fa2318396f05e13751a6d764509abd12387dfc992

SHA512
72e309ee593e8ed992ba8a5c7f68cc1e7e2e4cb73046faf1ec74eec70f5d69e6683defb5353e8457993508cbf1a23e0717f9858b19a5dbf75443983abce3f56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9676291.exe

Filesize
421KB

MD5
9317029894a912d9473a2ae52b82340b

SHA1
a62f06447fa6c5217f080314e98304cea3884dd4

SHA256
bda370090cffdd941053123c99e19b0c28973639d580e50c57c46dc462b9041c

SHA512
a8adebf777fb37dccb1122f48adb2c6be919617d5bbc43fbd4dd3463427bd4e3248ffab87fb1ac403953557127a40f756e1d584f3a4484621c134cc39054c8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2365043.exe

Filesize
251KB

MD5
2db816bdda1418080b87a0d1cf8c884b

SHA1
07992b73cb3c712772c190ac6ced460219cb9a1d

SHA256
7e173199111546404d7f4254a9d03f6079c0191ead5f1abc80c213783b1ae71b

SHA512
c879e11ffaf08b1ecc6a15f8d86fc92dbbc230b0c2c80ab9a9c83db09dda98b017f28192eeaae08618c50f20e8fb538d31c7aff247627e7d46cd28a8d8277f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8837151.exe

Filesize
227KB

MD5
1eb34fe477ae48ebb74e5d8876e532ab

SHA1
4ecae97dc11a179234aeda06851fc2680227fb79

SHA256
fab94cff5e131a6a1f0ad11eb136913fc2e430d49bca7995455358a6afdc6189

SHA512
0ea05079e8c50fa46a5ee24579e57692d32953eb53ba4b02b4067ff826c99631be30cce952830156a56a87ede7ccbd207b9cca8c1c001727e9d12d2b0b858bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o1463937.exe

Filesize
176KB

MD5
211a06e9ae68ced1234252a48696431b

SHA1
69950e2ee2fafd177d1a295836713bfd8d18df9c

SHA256
0bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d

SHA512
b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2836-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2836-29-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/4456-38-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/5096-44-0x0000000000630000-0x0000000000660000-memory.dmp

Filesize
192KB

Download
memory/5096-48-0x0000000002420000-0x0000000002426000-memory.dmp

Filesize
24KB

Download
memory/5096-49-0x0000000005150000-0x0000000005768000-memory.dmp

Filesize
6.1MB

Download
memory/5096-50-0x0000000004B30000-0x0000000004C3A000-memory.dmp

Filesize
1.0MB

Download
memory/5096-51-0x0000000004AF0000-0x0000000004B02000-memory.dmp

Filesize
72KB

Download
memory/5096-52-0x0000000004C40000-0x0000000004C7C000-memory.dmp

Filesize
240KB

Download
memory/5096-53-0x0000000004CD0000-0x0000000004D1C000-memory.dmp

Filesize
304KB

Download